Group roles deletion export to other instances

[Javier Tirado1]

Hi guys,

Today I come with a bit of an intricate problem, but I cannot think of an easy way around it.

I have DEV and TEST instances and I deploy via Company Applications, so as long as a record is under one of my applications I will be able to publish and deploy on TEST without worries. Problem is: sometimes a record is not bounded to any application, in which case you have to use Update Sets (commonly), as in sys_user_group_has_role table, which relates roles to a group.

So the situation is the next one:

1. I update the roles (discard one, insert one) of an specific group (same sys_id in all instances) using the 'Edit' button on the related list.

2. I haven't recorded this into an Update Set.

3. Because I used the 'Edit' button, this somehow doesn't delete the relation record from the role I discarded, so I cannot recover it on the 'Deleted Records' table.

Now I find myself in a situation where, because I haven´t recorded the deletion of the group-role record, I have no way to pass this deletion to TEST instance, because even if I insert the same group-role relationship again, this relationship record will have a different sys_id.

I have thought of creating a script to query the group (as it have the same sys_id on both instances) in the sys_user_group_has_role table, delete all records and insert the group-role record I want, but it's not the best way to do it (specially when it reaches PROD).

Is there a way to manipulate the XML of an Update Set to manually insert a change? (speciallly having in mind that I can get the XML from the record to delete from TEST instance)

[Mark Manders · Accepted solution]

Why would you care if the relationship between a group and a role has a different sys_id? It is by default that data is not captured in update sets, which includes users, groups, groupmembers, group roles and user roles. Why would you allow users to have the same access on DEV as they do on PROD? Dev is not for them. 

If, in any way, you need to add roles to groups/users to groups for new development, why not do that through a fix script after deploying? The sys_id of the relationship record shouldn't be used anywhere and when you do a clone, everything will be the same again.

XML manipulation is absolute bad practice. Please don't share this kind of hacky behavior as solution. There are lots of people out there that simply don't know what they are doing, blindly copy ideas from others and ruin their instances. 

[Javier Tirado1]

Hi Mark,

The group I'm trying to update is meant to be a root group for several child from different companies, but the role inheritance breaks anyway with XML updates so it's a complete mess...

You are right, the fix script is a better idea. I'll create one to query the group-role relationships, delete them and create new ones with required roles, this way maybe role inheritance is fixed as well.